Infosys Settles $175 Million Lawsuit Over Cybersecurity Breach at US Subsidiary

In a significant move, Infosys has agreed to settle lawsuits related to a massive data breach at its US subsidiary, Infosys McCamish Systems. The breach, which took place in November 2023, exposed the personal data of around 6.5 million individuals, affecting both McCamish’s clients and customers. The settlement, valued at \$17.5 million (approximately Rs 152 crore), is aimed at resolving class-action lawsuits filed against the company.

The Settlement Details and Legal Proceedings

On March 13, 2025, Infosys filed a regulatory statement confirming that a settlement agreement was reached between McCamish and the plaintiffs during mediation. This agreement would settle ongoing lawsuits against McCamish and its customers related to the breach. The settlement, once finalized, is expected to resolve all outstanding legal disputes without any admission of liability from the company.

However, the settlement is still subject to a series of confirmations: due diligence by the plaintiffs and final approval by the court. The regulatory filing further clarified that the settlement would only be binding once it is officially approved.

The breach was linked to a ransomware attack that occurred in February 2024, which Bank of America identified as being sourced from McCamish. The attack led to the exposure of over 57,000 users’ personal information, causing a ripple effect in legal proceedings. As a result, multiple lawsuits were filed against McCamish, which eventually led to the proposed settlement agreement. In addition, Infosys had acknowledged the breach’s financial impact, revealing that it reduced its operating margins by 60 basis points.

What Undercode Says: Analysis of the Breach and Its Impact

This data breach and its aftermath serve as a stark reminder of the risks associated with cybersecurity vulnerabilities, especially within large multinational corporations. McCamish, a subsidiary of Infosys, was responsible for safeguarding sensitive customer information, yet failed to prevent unauthorized access, which has now resulted in significant legal and financial ramifications.

The ransomware attack that triggered the breach underscores the increasing sophistication of cyber threats. The fact that Bank of America was able to identify McCamish as the source of the leak highlights the growing role of financial institutions in identifying and mitigating such attacks. It’s crucial to understand that ransomware attacks are not just a threat to data security but can also cause cascading effects across an entire supply chain. The breach’s impact on Infosys’ operating margins further suggests that even large corporations with substantial resources can suffer from these incidents.

Moreover, the proposed \$17.5 million settlement may seem substantial at first glance, but for a company the size of Infosys, it is likely to be seen as a cost of doing business, rather than a deterrent against future breaches. This raises a pertinent question: Does the financial burden of legal settlements truly drive meaningful change in cybersecurity practices within large corporations? In this case, it seems that it may not.

Fact Checker Results:

✅ Confirmed breach source: Bank of America identified McCamish as the source of the data leak.
✅ Ransomware attack: The breach was caused by a ransomware attack that affected 57,000 users.
❌ No admission of liability: Infosys is settling without admitting liability, which is common in such cases.

Prediction:

Looking ahead, we can expect further scrutiny on Infosys’ cybersecurity practices. As cyber-attacks grow in sophistication, both regulatory bodies and clients are likely to demand stricter data protection measures. Moreover, other firms in similar sectors may take this as a cautionary tale, leading to more proactive cybersecurity reforms. It’s possible that the final court approval of this settlement will push for more rigorous oversight and transparency from companies handling sensitive data.